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Abstract 

The NASA Airborne Subscale Transport 
Aircraft Research (AirSTAR) project is an 
Unmanned Aerial Systems (UAS) test bed for 
experimental flight control laws and vehicle 
dynamics research. During its development, the test 
bed has gone through a number of system 
permutations, each meant to add functionality to the 
concept of operations of the system. This enabled the 
build-up of not only the system itself, but also the 
support infrastructure and processes necessary to 
support flight operations. These permutations were 
grouped into project phases and the move from 
Phase-III to Phase-IV was marked by a significant 
increase in research capability and necessary safety 
systems due to the integration of an Internal Pilot into 
the control system chain already established for the 
External Pilot. 

The major system changes in Phase-IV 
operations necessitated a new safety and failsafe 
system to properly integrate both the Internal and 
External Pilots and to meet acceptable project safety 
margins. This work involved retrofitting an existing 
data system into the evolved concept of operations. 
Moving from the first Phase-IV aircraft to the 
dynamically scaled aircraft further involved 
restructuring the system to better guard against 
electromagnetic interference (EMI), and the entire 
avionics wiring harness was redesigned in order to 
facilitate better maintenance and access to onboard 
electronics. This retrofit and harness re-design will be 
explored and how it integrates with the evolved 
Phase-IV operations. 

AirSTAR Overview 

The Airborne Subscale Transport Aircraft 
Research (AirSTAR) project is part of NASA’s 


Aviation Safety Program (AvSP) and is a UAS 
platform for the testing of experimental flight control 
laws and other vehicle dynamics research [1] [2]. Its 
current incarnation provides a dynamically scaled 
General Transport Model (GTM) aircraft controlled 
via a ground-based internal pilot uplink with a 
supplementary external pilot for take-off, landing, 
and safety maneuvering purposes. All flight data is 
transmitted via RF link to the Mobile Operations 
Station (MOS). The MOS contains the internal 
piloting and research personnel stations, houses the 
hardware on which the ground flight control system 
executes and uplinks the generated command output 
back to the aircraft [3]. Both data and control latency 
are characterized and factored into the design of the 
system. 

This Phase-IV operational model was arrived at 
through a four-phase implementation schedule. This 
phased approach (Table 1) allowed functionality and 
support infrastructure to be built upon the previous 
phase and reduce the project implementation risk. 
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Table 1. AirSTAR Phased Implementation 


In Phase-IV operations (Figure 1), the External 
Pilot performs the take-off procedure, gains 
appropriate altitude, hands off control of the aircraft 
to the Internal Pilot in the MOS who performs the 
research maneuvers, and then the External Pilot re- 
establishes control and performs the landing 
maneuver. 





Figure 1. AirSTAR Phase-IV Concept of Operations 


The initial Phase-I work encompassed 

developing the procedures and infrastructure 
necessary for deploying with the aircraft for 
operations while flying with only External Pilot 
control. Phase-II added the data system and telemetry 
downlink into the system and procedures, but still 
was only operating using an External Pilot. The 
Phase-III work integrated the MOS as the receiving 
station for telemetry data, but the internal piloting 
station was not used to control the aircraft, instead 
still relying only on the External Pilot. Finally, 
Phase-IV integrated the Internal Pilot into the 
operations as described above, and integrated the 
system into the actual dynamically scaled General 
Transport Model. The review of the hardware 
implementation and retrofit begins with a discussion 
of the Phase-III to Phase-IV transition. 


Phase-III to Phase-IV(a) Transition 

The AirSTAR Phase-III implementation was 
marked by the successful downlink of telemetry data 
to the MOS while flying the aircraft under control of 
an RC External Pilot. Prior to Phase-III the data had 
been transmitted to a laptop station on the ground. 
The MOS allowed greater real-time and post data 
analysis in the field, increasing the flight turn-around 
and mission planning speed. Planned flight 
maneuvers were able to be altered based on data 
reviewed on site immediately following a research 
flight. Missing from Phase-III is the Internal Pilot 
uplink command to aircraft. The lack of Internal 
Pilot control results in a simple servo control path 
with the servos connected directly to the External 
Pilot receiver unit (Figure 2). 







Figure 2. Phase-III Servo Control Path 

Data telemetry, provided by the Flight Control 
Unit (FCU) (RF link omitted for brevity), is a 
completely separate power system and does not 
integrate with servo control at all in Phase-III 
operations. The FCU Data System (Figure 3) 
consists of three major components. These are the 
analog sampling hardware (omitted from command 
path illustrations for brevity), the “data system” 
which commutates and decommutates uplink and 
downlink data, including uplinked Internal Pilot 
commands, and the servo command Safety Switch. 
The Safety Switch was not in use during Phase-III 
and was the major focus of implementation during 
the move to Phase-IV operations. 



Figure 3. AirSTAR Flight Control Unit 

The main challenge in acquiring successful 
research data in Phase-III was the sensitivity of the 
External Pilot RC receiver to externally generated 
electro-magnetic interference (EMI). FCU-generated 
EMI would cause the RC receiver to enter a failsafe 
condition due to a detected loss of link with the 
pilot’s transmitter. This failsafe condition causes 


preset surface positions to be executed in order to 
bring the aircraft down with a minimum amount of 
ground distance coverage. Phase-III was using an 
older 72MHz RC system and in order to combat this 
problem a number of tactics were employed. 

Anechoic chamber measurements of the 
aircraft’s EMI characteristics were made to 
understand how different parts of the electronics 
contributed to the issue (Figure 4). 



Figure 4. S-2 Model In Anechoic Chamber 

Once the EMI characteristics of the airborne 
electronics were understood, channel selections for 
the 72MHz RC receiver were made to avoid the most 
problematic frequency ranges. Improved shielding 
on the FCU was also employed to attempt to squelch 
emissions from the system (Figure 5). 



Figure 5. Shielded FCU In Anechoic Chamber 



Since the anechoic chamber results indicated 
that the FCU itself was the major contributor of EMI, 
a failsafe strategy to assure protection of the aircraft 
was employed. If the External Pilot RC receiver 
were to enter its failsafe condition, it would trigger a 
shutdown of the FCU in order to eliminate the EMI 
source and re-establish the External Pilot control link. 

The hardware that detected the failsafe and 
triggered the shutdown was known as the FCU Kill 
Switch and was implemented using a parallel system 
of asynchronous RC -based switches (similar to those 
traditionally used for ignition switch applications). A 
pulse-width modulation (PWM) signal pulse time of 
lms indicated a failsafe condition to trigger the 
system. The FCU Kill Switch was retrofitted into the 
existing power harness and worked well to protect 
the airframe during Phase-III deployments. 


Taking into account the Phase-III EMI failsafe 
strategy, the problem this new control path presents 
becomes apparent. All control systems now pass 
through the FCU Safety Switch, so the Internal and 
External piloting systems are no longer discrete 
systems. If the FCU is powered off in order to 
mitigate EMI then all pilots are severed from servo 
control, and specifically the External Pilot, the very 
piloting link the system needs to preserve. 

Despite this, the decision was made to preserve 
the current EMI mitigation strategy moving forward 
through Phase-IV. This was done for both 
operational awareness purposes and uncertainty about 
the timeline for transitioning to a potentially more 
EMI-resistant External Piloting system. Obviously, 
this decision would require more changes and 
hardware retrofits into the existing avionics system. 


Moving from Phase-III to Phase-IV the 
milestone was to successfully fly the aircraft from the 
Internal Pilot station for actual research maneuvers. 
This affords more precise research control than is 
possible with the External Pilot so that more 
advanced research can be accomplished. 

At a hardware level, Phase-IV necessitated the 
introduction of the FCU’s previously unused 
hardware Safety Switch. The Safety Switch is able to 
switch between uplinked Internal Pilot commands 
and another servo command source. The switch is 
controlled by an external PWM signal from the 
External Pilot receiver. This makes the External Pilot 
the pilot-in-command since he controls which pilot is 
flying the aircraft. This changes the servo control 
path from the original Phase-III implementation to a 
new control path utilizing the Safety Switch (Figure 
6 ). 
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The system would continue to use the FCU 
Safety Switch under nominal flight conditions. 
Nominal Intemal-to-Extemal Pilot handoffs, and vice 
versa, would occur in the FCU Safety Switch. Even 
in the case of FCU telemetry link failure (ie. uplink 
commands from the MOS are not reaching the data 
system), the External Pilot would be given command 
of the aircraft via the FCU Safety Switch and the 
FCU would remain operational. When the External 
Pilot RC link went into failsafe it would still power 
off the FCU, but this essentially requires the External 
Pilot commands to then be routed around, or bypass, 
the FCU. This creates the servo control path 
illustrated below (Figure 7). 


Servos 



Figure 6. Phase-IV Concept Servo Control Path 


Figure 7. Servo Control Path w/ Bypass 


This second unit was known as the Bypass 
Switch, and in conjunction with the FCU Kill Switch 
enabled the transition of the existing failsafe strategy 
into Phase-IV operations. 

As in Phase-III, the initial hardware 
implementation of this system was retrofitted into the 
existing avionics wiring harness. The Bypass Switch 
itself was implemented using a group of analog 
multiplexer ICs that were directly switched based on 
the failsafe state of the External Pilot receiver. At the 
same time, the Kill Switch was redesigned from the 
original RC switch-based design to a D-Flip Flop 
implementation so that the packaging could be 
minimized while retaining the same design (Figure 
8). Even though the hardware implementation was 
refined, the two units still required two separate 
enclosures that added to the complexity of the 
avionics wiring harness itself and to the weight of the 
aircraft. 



Figure 8. Kill Switch D-Flip Flop Implementation 

This implementation of the FCU Kill Switch and 
the Bypass Switch flew on the initial Phase-IV flights 
that were done with the non-dynamically scaled S-2 
vehicle (Figure 4). 

Phase-IV(a) to Phase-IV(b) Transition 

The initial transition into Phase-IV came to be 
known as Phase-IV(a) due to the fact that it was done 
using the non-dynamically scaled S-2 aircraft. After 
successful deployment of the full Phase-IV capability 
in this aircraft, the build-up of the same system in a 


dynamically scaled general transport model (GTM), 
T-2, became known as Phase-IV(b). 

Design Change Rationale 

A dynamically scaled aircraft can be 
mathematically related to its full-scale counterpart, 
allowing for flight research of larger vehicles in 
smaller models [4]. The nature of dynamically 
scaling an aircraft requires meeting metrics for both 
weight and CG of the of the scale model. The 
aircraft’s propulsion and fuel systems set limits on 
airspeed, and the physical model itself sets limits on 
size and g-limits. Therefore, in the same way the 
weight of model must be carefully built so that at 
some point during flight the proper dynamic scaling 
of the aircraft under study is attained during which 
data points can be that made a repackaging of the 
data system necessary. Therefore, the prime 
motivation for the work on the GTM model’s 
avionics harness was motivated by better controlling 
the weight and weight distribution of the electronics 
in the T-2 model (Figure 9). The final T-2 aircraft 
was a 5.5% dynamically-scaled model weighing 
approximately 58 lbs., including fuel, at take-off, 
with a wingspan of 85 inches. 



Figure 9. Dynamically Scaled GTM T-2 Model 

Ease of access to system components for 
debugging was found to be an issue in the initial 
system as well, and this issue had a chance to be 
addressed during this fabrication effort. EMI 
mitigation was another primary driver behind the 
fabrication effort for the T-2 avionics, and there were 
some operational bugs in the initial retrofitted 
hardware that needed to be addressed. 




All of these considerations resulted in great 
attention being paid to three major areas of the new 
electronics build effort. First, power distribution and 
associated EMI considerations, second, the redesign 
of the existing Bypass Switch system, and finally, the 
actual packaging of the electronics, which follows 
closely from the first two design efforts. 

Power Distribution and EMI 

The power system in Phase-IV is completely 
powered by traditional RC model Lithium-Ion battery 
packs, and requires three discrete battery systems to 
operate. One powers the FCU Data System and other 
avionics, the second powers the Engine Control Units 
(ECU) for the turbine engines, and the third powers 
the External Pilot RC piloting system and the servos 
themselves. 

Initially, no consideration was paid in the 
harness itself to isolating these systems. In fact, 
power regulation and distribution for everything, 
including the servos, was housed in the same 
enclosure as the data system Measurements of both 
actual noise generated by the servos and the general 
transient behavior of the current requirements of the 
servo system made it prudent to isolate the FCU Data 
System power from the RC piloting system and 
servos. To this end a grounding tree was devised to 
map out the power systems of the aircraft avionics. 



Figure 10. Power Distribution Unit PCB 


Central to this grounding tree was a Power 
Distribution Unit (PDU) that was designed to house 
most of the power regulation in the aircraft (Figure 
10). The PDU kept the power and ground rails of the 
data/sensor system isolated from the servos and ECU 
power systems, and served as the central distribution 
point for most aircraft power. Since it was so central 
to the system it was also designed to serve as the 
central connection point for all of the servos in the 
aircraft. 

Major design components of the PDU included 
EMI filters on all battery input rails, and discrete 
separation of power regulation areas in the board 
design phase. Line drivers were also used on all 
servo command outputs in the case that servo cabling 
was to be long, since final placement of the PDU in 
the aircraft was not known until later in the design 
phase. 

The FCU Data System was given its own 
enclosure, with only a small amount of voltage 
regulation necessary for sensor excitation and small 
logic needs actually being performed inside the 
enclosure. Fabrication and external connector 
positions were carefully chosen as to prevent power 
wiring internal to the enclosure from running near 
analog sampling hardware of the data system. 

Bypass & Kill Switch Redesign 

During Phase-IV(a) post-deployment activities it 
was discovered that the retrofitted Kill and Bypass 
Switch system was extremely sensitive to system 
noise and power current transients. Sudden current 
draws, the result of large, fast, simultaneous servo 
movements across a number of aircraft servos would 
result in a drop of the servo power rail and the PWM 
command signal. While the servos themselves 
seemed resilient to these power transients, the RC 
switches used in the Kill Switch were not and would 
detect these lowered voltage-level PWM signals as 
actual zero percent duty-cycle pulses. This would 
result in the Kill Switch detecting a failsafe condition 
when, in fact, there was none. 

Since the entire avionics system was to be 
repackaged, the decision was made to redesign the 
retrofitted system and integrate the Bypass Switch 
and Kill Switch into a single board system. 
Furthermore, the system would be fabricated so as to 


fit natively on the FCU Data System footprint and 
reside within the same enclosure. 

The redesigned system was implemented using a 
VHDL design in a Xilinx Coolrunner XPLA3 CPLD 
device, and verified through test flights on a simple 
Ultrastick prop aircraft. 


The major VHDL modules (Figure 11) 
developed for the system implementation were a 
pulse-length detector (PWMCOUNTER.vhd), a 
failsafe pulse counter (FAILSAFECOUNTER.vhd), 
a generic switching module (SWITCH.vhd), and the 
switch’s controlling state-machine 

(BYPASSSTATEMACHINE.vhd). 
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Figure 11. Phase-IV(b) Bypass Switch VHDL Configuration 


All of the modules are synchronous with the 
exception of the switching module itself. The pulse- 
length detector generates a 16-bit count to indicate 
the pulse-length of the current pulse-width 
modulation signal. This count is fed into the failsafe 
pulse counter that compares it to a static metric value 
equivalent to 1ms in order to determine if the pulse 
length indicates a failsafe condition. The pulse 
counter keeps a count of the train of failsafe- 
indicating pulses until either a count threshold is 
reached, or the pulses stop indicating failsafe. 

If the count threshold is reached first, the trigger 
from the failsafe pulse counter tells the state machine 
that the system has entered failsafe mode. If the 
pulse lengths stop indicating failsafe before the 
threshold is reached, the failsafe pulse counter resets 
its count and restarts waiting for pulses that indicate 
failsafe. The system state machine gets no indication 
of a failsafe event. 

This count threshold was derived to require 
failsafe to be indicated for approximately 0.25 
seconds before initiating the failsafe trigger. This 
allowed the system to be robust against the false- 
positive failsafe indications that would trigger the 
original system. 

The state machine module also controls the 
operational state of the Bypass Switch via the 
externally operable switches on the FCU enclosure. 
One switch simply turns the Bypass Switch on or off. 
The avionics system essentially operates as if the 
Bypass Switch was not present when the Bypass 


Switch is turned off. This was a useful mode during 
lab testing when External Pilot link failures were not 
a concern. 

The second switch determines the latching 
behavior of the Bypass Switch. When in latching 
mode the Bypass Switch permanently latches the 
system into External Pilot bypass mode - turning off 
the FCU Data System, and routing External Pilot 
commands directly to the servos - regardless of 
whether the External Pilot command link recovers 
later. 

When in non-latching mode the Bypass Switch 
will move out of its bypass state - turning the FCU 
Data System back on, and using the FCU Switch 
servo outputs - when the External pilot link returns to 
a standard operational state. Non-latching mode is 
used only during lab tests, integration testing of the 
system and on the flight line during pre-flight and 
thru-flight procedures. The pre-flight and thru-flight 
checklists ensure the aircraft is returned to latching 
mode prior to flight. 

Finally, the actual layout of the redesigned 
Bypass Switch system was designed to work with our 
developed Power Isolation and EMI strategy (Figure 
12). The Bypass Switch has a necessary interface 
between the External Piloting power system and the 
FCU Data System power system, and proper isolation 
was necessary. 

EMI filters, as found in the PDU, are used on 
this board as well for the power inputs. External 
Pilot servo commands enter from the bottom of the 


board and pass through the array of isolation devices 
before going to the system logic that runs from the 
FCU Data System power rail. 



FCO 

Power 

Rail 


Ext. 

Pitot 

Sysieu 

Power 

Rail 


Figure 12. P-IV Bypass Switch Board 

The FCU Data System Safety Switch outputs 
enter from the top of the board with no isolation 
necessary since the components share the same 
power system. The selected output commands exit 
out the right of the board, passing through line 
drivers due to the cable length between the Safety 
Switch and the PDU, where the servo commands are 
then all distributed to the servos. In the PDU, 
isolation is also provided where the servo command 
signals pass from the FCU power system into the 
External Pilot and Servo power system. 

Avionics Packaging Redesign 

All of the effort expended in the redesign would 
be meaningless if the packaging of the electronics 
was not addressed as well. The main issues 
addressed were cable shielding, individual 
component construction, and component layout in the 
aircraft. 

Single-ended grounded shielding was utilized 
throughout the system as a guard against EMI 
emissions. The primary enclosures for the two main 
components, the FCU and the PDU, were redesigned 
to accommodate better connectors and have proper 
mounting in the aircraft (Figure 13) (Figure 14). 



Figure 14. FCU Enclosure, T-2 Mount 

Many of the initial Phase-III enclosures had 
umbilical style cabling that could not be removed, 
making it difficult to replace discrete components in 
the aircraft. This was mainly due to the way in which 
the build-up was done, but the move to T-2 allowed 
for this repackaging, as illustrated, which allowed 
both easier troubleshooting of the system, and 
simpler replacement of components. 

Finally, a good deal of the EMI-instigated 
problems with the External Pilot link were mitigated 
by moving away from the older 72MHz External 
Pilot hardware and to the newer 2.4GHz Spread 
Spectrum hardware available from the RC aircraft 
vendors. The EMI noise from the FCU did not affect 
this higher frequency range nearly as much as it did 
the 72MHz system. 





Phase-IV(b) System Deployment 

The redesigned T-2 avionics hardware system 
was deployed for the first time at Wallops Island, VA 
in September, 2009. The system to date has flown a 
total of fifty-eight research flight missions. 

Conclusion and Future Work 

The effort to retrofit hardware into the Phase-IV 
FCU Data System allowed the stand-up of a fully 
functional Phase-IV capability for research utilizing a 
5.5% dynamically scaled GTM aircraft. This 
avionics work was necessary to meet safety assurance 
measures required by the AirSTAR project for flight, 
and successfully integrated both the Internal Pilot and 
the External Pilot, as pilot-in-command, together to 
form the backbone of the research operations 
provided by the AirSTAR UAS system. 

Future work sees AirSTAR capability expanding 
even further as the project is designing and 
implementing a new system to enable beyond visual 
range operations utilizing exclusive Internal Pilot 
control in the MOS. This will allow the expansion of 
the operational and hazard areas of the system and 
allow for a wider range of research applications for 
the system. 
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